CVE-2019-0344

SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

Commerce Cloud

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

14. Aug 2019

Ausgewertete Quellen

• Hersteller
  https://launchpad.support.sap.com/#/notes/2786035
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0344
• CISA
  SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
• NVD
  CVE-2019-0344